Tunnel Routing
Load Balancing & Fault Tolerance
Priority over Auto Routing and NAT
Tunnel Routing rules are in higher priority than Auto Routing rules and NAT rules for FortiWAN matching packets with.
Predefine a Tunnel Routing rule, a Auto Routing rule (See "
") and a NAT rule (See "
") with the same
source and destination, packets that are indicated the source and destination will be first matched to the Tunnel
Routing rule and transferred by Tunnel Routing, without be processed by FortiWAN's Auto Routing and NAT.
Healthy detection for tunnels
Tunnel Routing maintains a unique mechanism of healthy detection for tunnels, which is different from FortiWAN's
WLHD (See "
"). Symmetric FortiWAN sites continue sending GRE encapsulated detection
packets to each other via the defined tunnels. The detection receiver on each FortiWAN site decides the status of a
tunnel (OK or Fails) by monitoring if the detection packets arrive continuously. Tunnel Routing's balancing algorithms
distribute packets only over those healthy tunnels, so that the network connection and the data transfer reliability are
guaranteed. Tunnel Routing's healthy detection contains the whole connection between two FortiWAN sites (from the
WAN link one side to the WAN link another side via Internet), while WLHD only detects the status of connections to
Internet. Therefore, the two mechanisms might show different detection result. For example, the Web UI reports a
WAN link is OK but a tunnel established with the WAN link is failed. This might be the failed WAN link on the opposite
site of the tunnel. For another example, the Web UI reports a WAN link is failed but a tunnel established with the WAN
link is OK. This might because a incorrect configuration to WLHD results in incorrect detection.
Dynamic IP addresses and NAT pass through
FortiWAN's Tunnel Routing supports dynamic IP addresses and NAT pass through. Only one
static public IP
address
(No NAT employed to the static IP address) is required for tunnel routing deployment between the symmetric
FortiWAN sites. A negotiation will be dynamically performed via the only one static public IP address to synchronize
the dynamic IP addresses and the IP addresses of NAT device to each other. Therefore, changes on dynamic IP
addresses or IP addresses NAT device causes no damage to tunnel connections. Note that NAT pass through for
Tunnel Routing here is not the NAT function of FortiWAN, FortiWAN will never perform NAT translation for tunnel
packets. The NAT pass through here is for the application that another NAT device in front of FortiWAN. Usually, this
happens when a ISP provides WAN links with private IP addresses and does NAT translation for the private WAN links
on the ISP side.
FortiWAN Handbook
Fortinet Technologies Inc.
139
